Detected: https://www.virustotal.com/nl/url/88c6275a00504492123c843af87fb8144c5c9f3e557183f174246419f7b2f84a/analysis/1426184670/
Missed here: http://sitecheck.sucuri.net/results/pzqwqr.fo.ru but Outdated software detected: Outdated Web Server Nginx Found: nginx/1.2.8
10 malicious files with detected reference to malicious blacklisted domain -koqrcf.fo.ru, -goftnv.fo.ru,
30 suspicious files with detected reference to suspicious blacklisted domain -am15.net
Potentially Suspicious files: 1
/common/jquery/plugins/jquery.ba-hashchange.min.js?11788
Severity: Potentially Suspicious
Reason: Suspicious JavaScript code injection.
Details: Procedure: + has been called with a string containing hidden JavaScript code .
Threat dump: View code: https://www.uploady.com/download/zvUaYkOfWFn/MK3qHUbMN2xhL73v
Threat dump MD5: E0D0AF8E6A71A5B9CC9026F3F82F4871
File size[byte]: 1526
File type: ASCII
Page/File MD5: 757898A5793D29189E52CA6EE8FCE808
Scan duration[sec]: 0.181000
Javascript check suspicious:
Included scripts: Suspect - please check list for unknown includes
htxp://am15.net/sb.php?s=45130
Suspicious Script:
-pzqwqr.fo.ru//common/mlp/js/anonymous.lib.js?11788
.ru/market"; }, applets_content: function() { if($(‘#tp_applets_content’).length){ $(‘#tp_applets_content’).toggle();
404 error check: Suspicious Suspicious 404 Page:
Cide hick-up:
pzqwqr.fo.ru/ajax?form&service=blog&curfolder=&curitem= benign
[nothing detected] (jsvar) -pzqwqr.fo.ru/ajax?form&service=blog&curfolder=&curitem=
status: (referer=pzqwqr.fo.ru/)saved 4212 bytes 5ca82bb6eb0284da62d575f65f01b2c2b78201c3
info: [decodingLevel=0] found JavaScript
error: undefined variable MLP
suspicious: maxruntime exceeded 10 seconds (incomplete) 0 bytes
error: undefined variable MLP.Utils
error: line:1: SyntaxError: missing ; before statement:
error: line:1: var MLP.Utils = 1;
error: line:1: …^
error: line:5: SyntaxError: missing } in XML expression:
error: line:5: position:absolute;
error: line:5: …^
Other malware on IP: https://urlquery.net/report.php?id=1425133092572
Tracker Tracker report for external links etc.
Do not try to open up links inside a browser, results given for research purposes only.
polonus (volunteer website security analyst and website error-hunter)